Security device with extended reliability

Abstract

A security hardware device is configured to secure a control apparatus. The security hardware device includes a data security domain; a functional safety domain; a data security processor provided in the data security domain and is configured to secure data from unauthorized access or manipulation; a functional safety processor provided in the functional safety domain and is configured to detect functional errors and generate respective safety alerts in response to detecting the functional errors; and a monitoring processor configured to analyze the respective safety alerts provided by the functional safety processor for at least one pattern of safety alerts indicative of a security attack and generate a response signal in response to the respective safety alerts having at least one of the at least one pattern of safety alerts.

What is claimed is: 
     
       1. A security hardware device configured to secure a control apparatus, the security hardware device comprising:
 a data security domain; 
 a functional safety domain; 
 a data security processor provided in the data security domain and is configured to secure data from an unauthorized access or manipulation occurring during a debugging access of the control apparatus; 
 a functional safety processor provided in the functional safety domain and is configured to detect functional errors based on the unauthorized access or manipulation and generate respective safety alerts in response to detecting the functional errors; and 
 a monitoring processor configured to analyze the respective safety alerts generated by the functional safety processor for at least one pattern of safety alerts indicative of a security attack and generate a response signal in response to the respective safety alerts having at least one of the at least one pattern of safety alerts indicative of the security attack. 
 
     
     
       2. The security hardware device according to  claim 1 , wherein the monitoring processor is configured to analyze the respective safety alerts generated by the functional safety processor over a predetermined period of time for the at least one pattern of safety alerts indicative of the security attack. 
     
     
       3. The security hardware device according to  claim 1 , wherein:
 the functional safety processor comprises two or more security hardware components configured to detect the functional errors corresponding to different hardware components of the control apparatus and generate the respective safety alerts, and 
 the monitoring processor is configured to analyze the respective safety alerts provided by the two or more security hardware components, in combination, for the at least one pattern of safety alerts indicative of the security attack. 
 
     
     
       4. The security hardware device according to  claim 1 , wherein the functional safety processor is configured to generate a respective safety alert, of the respective safety alerts, in response to detecting one or more functional errors. 
     
     
       5. The security hardware device according to  claim 1 , wherein the at least one pattern of safety alerts indicative of the security attack includes a reoccurring pattern of safety alerts, wherein the monitoring processor generates the response signal in response to detecting that the respective safety alerts occur in a reoccurring pattern in accordance with the reoccurring pattern of safety alerts. 
     
     
       6. The security hardware device according to  claim 5 , wherein the at least one pattern of safety alerts indicative of the security attack includes a simultaneous pattern of safety alerts, wherein the monitoring processor generates the response signal in response to detecting that the respective safety alerts occur simultaneously in accordance with the simultaneous pattern of safety alerts and in the reoccurring pattern in accordance with the reoccurring pattern of safety alerts. 
     
     
       7. The security hardware device according to  claim 1 , wherein the at least one pattern of safety alerts indicative of the security attack includes a simultaneous pattern of safety alerts, wherein the monitoring processor generates the response signal in response to detecting that the respective safety alerts occur simultaneously in accordance with the simultaneous pattern of safety alerts. 
     
     
       8. The security hardware device according to  claim 1 , wherein the functional safety processor comprises:
 a first security hardware component configured to detect a first set of functional errors corresponding to a first set of components of the control apparatus and generate first safety alerts of the respective safety alerts in response to detecting the first set of functional errors; and 
 a second security hardware component configured to detect a second set of functional errors corresponding to a second set of components of the control apparatus and generate second safety alerts of the respective safety alerts in response to detecting the second set of functional errors,
 wherein the monitoring processor is configured to analyze the first safety alerts and the second safety alerts, in combination, for the at least one pattern of safety alerts indicative of the security attack. 
 
 
     
     
       9. The security hardware device according to  claim 8 , wherein the first set of components are different from the second set of components. 
     
     
       10. The security hardware device according to  claim 8 , wherein the first security hardware component is configured to operate in a first operating mode and the second security hardware component is configured to operate in a high-availability mode, wherein the high-availability mode is available independently from the first operating mode. 
     
     
       11. The security hardware device according to  claim 1 , wherein the data security processor is configured to receive the response signal, and to output a further response signal indicative of a data surety fault in response to the response signal. 
     
     
       12. The security hardware device according to  claim 11 , wherein the data security processor comprises:
 a first security hardware component configured to operate in a first operating mode; and 
 a second security hardware component configured to operate in a high-availability mode that is available independently from the first operating mode,
 wherein the first security hardware component and the second security hardware component are configured to receive the response signal from the monitoring processor and output a further response signal allocated to a respective one of the first security hardware component and the second security hardware component on a basis of the received response signal. 
 
 
     
     
       13. The security hardware device according to  claim 12 , wherein the functional safety processor comprises:
 a third security hardware component configured to detect a first set of functional errors corresponding to a first set of components of the control apparatus and generate first safety alerts of the respective safety alerts in response to detecting the first set of functional errors; and 
 a fourth security hardware component configured to detect a second set of functional errors corresponding to a second set of components of the control apparatus and generate second safety alerts of the respective safety alerts in response to detecting the second set of functional errors,
 wherein the monitoring processor is configured to analyze the first safety alerts and the second safety alerts, in combination, for the at least one pattern of safety alerts indicative of the security attack. 
 
 
     
     
       14. The security hardware device according to  claim 13 , wherein the third security hardware component is configured to operate in the first operating mode and the fourth security hardware component is configured to operate in the high-availability mode. 
     
     
       15. The security hardware device according to  claim 1 , wherein:
 the data security processor is configured to generate at least one warning signal and transmit the at least one warning signal to the functional safety processor, 
 the functional safety processor is configured to output a configurable response signal in response to receiving the at least one warning signal, and 
 wherein the functional safety processor is configured as a security management device and is configured to transmit security fault events of the functional safety processor as the configurable response signal selectively to the data security processor, wherein the data security processor is configured to output a further warning signal in response to receiving the configurable response signal. 
 
     
     
       16. The security hardware device according to  claim 15 , wherein:
 the data security processor comprises:
 a first security hardware component configured to operate in a first operating mode; and 
 a second security hardware component configured to operate in a high-availability mode that is available independently from the first operating mode, 
 
 the functional safety processor comprises:
 a third security hardware component configured to operate in the first operating mode; and 
 a fourth security hardware component configured to operate in the high-availability mode, 
 
 a clock domain of the first security hardware component is different from a second clock domain of the second security hardware component, 
 a voltage domain of the third security hardware component is separated from a further voltage domain of the fourth security hardware component, and 
 the data security processor is configured to transmit the at least one warning signal from the data security processor to the third security hardware component or to the fourth security hardware component based on an operating mode selected from the first operating mode and the high-availability mode,
 wherein respective one of the third security hardware component and the fourth security hardware component is configured to transmit the configurable response signal in response to receiving the at least one warning signal. 
 
 
     
     
       17. The security hardware device according to  claim 15 , wherein the functional safety processor has a communication connection to a monitoring circuitry of the data security processor, wherein the monitoring circuitry of the data security processor is configured to detect security fault events of the data security processor and transmit the security fault events to the functional safety processor, and wherein the monitoring circuitry of the data security processor is arranged in the functional safety domain. 
     
     
       18. The security hardware device according to  claim 15 , wherein the data security processor has a communication connection to a monitoring circuitry of the functional safety processor, wherein the monitoring circuitry for monitoring the functional safety processor is configured to detect security fault events of the functional safety processor and transmit the detected security fault events to the data security processor, and wherein the monitoring circuitry of the functional safety processor is arranged in the data security domain. 
     
     
       19. The security hardware device according to  claim 16 , further comprising:
 a second monitoring processor configured to operate in the high-availability mode, wherein the second monitoring processor is configured to detect a fault present in the third security hardware component and is arranged in the fourth security hardware component and has a communication connection to the fourth security hardware component, and wherein the fourth security hardware component is configured to output a third response signal if a fault is detected by the second monitoring processor; and 
 a third monitoring processor configured to detect a fault present in the fourth security hardware component which has a communication connection to the third security hardware component. 
 
     
     
       20. The security hardware device according to  claim 1 , wherein the functional safety processor comprises:
 a first security hardware component configured to operate in a first operating mode; and 
 a second security hardware component configured to operate in a high-availability mode, wherein the high-availability mode is available independently from the first operating mode; 
 wherein the security hardware device further comprises:
 a second monitoring processor arranged in the second security hardware component and has a communication connection to the second security hardware component, wherein the second monitoring processor is configured to operate in the high-availability mode and is configured to detect a fault present in the first security hardware component, the second security hardware component is configured to output a first response signal if a fault is detected by the second monitoring processor; and 
 a third monitoring processor arranged in the first security hardware component and has a communication connection to the second security hardware component, wherein the third monitoring processor is configured to detect a fault present in the second security hardware component, wherein the first security hardware component is configured to output a second response signal if a fault is detected by the third monitoring processor. 
 
 
     
     
       21. The security hardware device according to  claim 20 , wherein:
 the first security hardware component is configured to detect a first set of functional errors corresponding to a first set of components of the control apparatus and generate first safety alerts of the respective safety alerts in response to detecting the first set of functional errors, 
 the second security hardware component is configured to detect a second set of functional errors corresponding to a second set of components of the control apparatus and generate second safety alerts of the respective safety alerts in response to detecting the second set of functional errors, and 
 the monitoring processor is configured to analyze the first safety alerts and the second safety alerts, in combination, for the at least one pattern of safety alerts indicative of the security attack.